Self.xyz + SelfClaw

SelfClaw uses Self.xyz for passport-based identity verification with zero-knowledge proofs. Here's what makes this approach special:

How It Works

SelfClaw uses Self.xyz's zero-knowledge proof system to verify passport ownership without exposing personal data. Here's the flow:

Implementation Guide

Step 1: Request a Signature

Generate a unique challenge for the agent to sign. Include a nonce and timestamp to prevent replay attacks.

// Generate a unique challenge
const challenge = {
  action: "verify_agent",
  timestamp: Date.now(),
  nonce: crypto.randomUUID(),
  domain: "your-app.com"
};

// Ask the agent to sign this
const message = JSON.stringify(challenge);

Step 2: Verify the Signature

The agent returns their public key (SPKI format) and signature. Convert SPKI to raw key, then verify using Ed25519.

import { createPublicKey } from "crypto";
import { verify } from "@noble/ed25519";

// Agent returns: { publicKey (SPKI base64), signature }

// Convert SPKI to raw 32-byte key for @noble/ed25519
const spkiDer = Buffer.from(publicKey, "base64");
const keyObject = createPublicKey({ key: spkiDer, format: "der", type: "spki" });
const rawPublicKey = keyObject.export({ type: "spki", format: "der" }).subarray(-32);

// Verify signature
const isValidSignature = await verify(
  Buffer.from(signature, "base64"),
  message,
  rawPublicKey
);

if (!isValidSignature) {
  throw new Error("Invalid signature");
}

Step 3: Check SelfClaw Registry

Query the SelfClaw API to verify the public key is registered with passport verification.

// Check if the agent is verified (use query param for safety)
const response = await fetch(
  `https://selfclaw.app/api/selfclaw/v1/agent?publicKey=${encodeURIComponent(publicKey)}`
);
const data = await response.json();

if (data.verified) {
  console.log("Agent is backed by a verified human!");
  console.log("Human ID:", data.humanId);
  console.log("Agent Swarm:", data.swarm);
} else {
  console.log("Agent is not verified");
}

Check Verification

Verify if an agent is backed by a real human — instantly.

API Reference

Response Fields

Example Response

{
  "verified": true,
  "publicKey": "MCowBQYDK2VwAyEA...",
  "agentName": "my-research-agent",
  "humanId": "0x1234abcd...",
  "swarm": "https://selfclaw.app/human/0x1234abcd",
  "selfxyz": {
    "verified": true,
    "registeredAt": "2026-02-03T10:30:00Z"
  }
}

Other Endpoints

Security Considerations

• 1 Proof-to-key binding: During registration, the Self.xyz proof is bound to the agent's public key hash. This prevents replay attacks where someone reuses a proof to register different keys.
• 2 Unique challenges: Always include domain, nonce, timestamp, and agentKeyHash in challenges to prevent replay attacks.
• 3 Signature first: Always verify the cryptographic signature before checking the registry.
• 4 Track by humanId: Use the humanId to identify agents from the same human across your application.
• 5 Agent swarms: One human can operate multiple agents. Use the swarm endpoint to see all agents for a humanId.

OpenClaw Standard

SelfClaw implements the OpenClaw verification standard — an open spec that anyone can validate without trusting our API.

Challenge Format

{
  "domain": "your-app.com",
  "timestamp": 1738540800000,
  "nonce": "unique-random-string",
  "agentKeyHash": "sha256-of-agent-public-key"
}

Trust Model

SelfClaw is an API registry storing verification records in PostgreSQL. This provides fast lookups without blockchain fees. Optional on-chain anchoring on Celo is planned for stronger decentralization guarantees.

For AI Agents

Building with AI coding agents? Point them to our llms.txt for machine-readable integration instructions.

The llms.txt file contains:

• • Complete API reference with request/response formats
• • Code examples for JavaScript/TypeScript integration
• • Security best practices for verification flows
• • Why SelfClaw is the privacy-first choice